8004e946d330c980810f658f94d20e443f353124bcc980f1eba390e2b3f65437

Sharing

Copy URL Twitter E-mail

General

Target

8004e946d330c980810f658f94d20e443f353124bcc980f1eba390e2b3f65437
Size

10.4MB
MD5

1f90fdde5948e11708cdd7f757181004
SHA1

42539b4af85cb3dc0a5f9758109570f709a1a4f4
SHA256

8004e946d330c980810f658f94d20e443f353124bcc980f1eba390e2b3f65437
SHA512

76609c31b9f0e324d17c1c4b247ddd48c04c1a4cc04b99b8949d0f2cfbc70a39e34c5bb3db810ef5e110339347d9c86d2028092576921b4768238985975c1c6e
SSDEEP

196608:vguxKN1GNq6YOnyrIKgffJAuKMN+XFmwzyOB73OJv:Iux+1oqkyrb77K+1mwGw73iv

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

8004e946d330c980810f658f94d20e443f353124bcc980f1eba390e2b3f65437
.exe windows x64

Code Sign

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21
Certificate

Issuer

CN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)

Not Before

28/05/2023, 12:56

Not After

29/05/2033, 12:56

Subject

CN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:c3:90:3b:2a:1b:96:72:d7:db:c8:65:9e:09:df:6b:ca:66:d6:41:22:08:b0:3d:64:8c:e9:7a:e6:d0:fd:d6
Signer

Actual PE Digest

5e:c3:90:3b:2a:1b:96:72:d7:db:c8:65:9e:09:df:6b:ca:66:d6:41:22:08:b0:3d:64:8c:e9:7a:e6:d0:fd:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

Size: 53KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 6.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 19KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5e:c3:90:3b:2a:1b:96:72:d7:db:c8:65:9e:09:df:6b:ca:66:d6:41:22:08:b0:3d:64:8c:e9:7a:e6:d0:fd:d6Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 53KB - Virtual size: 122KB

Size: 6.6MB - Virtual size: 9.6MB

Size: 8KB - Virtual size: 19KB

Size: 4KB - Virtual size: 6KB

Size: 1KB - Virtual size: 4KB

.bss Size: - Virtual size: 15KB

Size: 512B - Virtual size: 2KB

Size: 512B - Virtual size: 96B

Size: 512B - Virtual size: 16B

Size: 19KB - Virtual size: 68KB

Size: 1024B - Virtual size: 816B

.idata Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.vmp0 Size: 4KB - Virtual size: 4KB

.themida Size: 3.7MB - Virtual size: 3.7MB

.vmp1 Size: 8KB - Virtual size: 7KB

.reloc Size: 512B - Virtual size: 16B

.rsrc Size: 4KB - Virtual size: 4KB

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5e:c3:90:3b:2a:1b:96:72:d7:db:c8:65:9e:09:df:6b:ca:66:d6:41:22:08:b0:3d:64:8c:e9:7a:e6:d0:fd:d6
Signer

.bss
Size: - Virtual size: 15KB

.idata
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.vmp0
Size: 4KB - Virtual size: 4KB

.themida
Size: 3.7MB - Virtual size: 3.7MB

.vmp1
Size: 8KB - Virtual size: 7KB

.reloc
Size: 512B - Virtual size: 16B

.rsrc
Size: 4KB - Virtual size: 4KB